The first course of action for the CIO of a financial services company to ensure IT processes are in compliance with recently instituted regulatory changes should be to perform a current state assessment. This is because a current state assessment can help to evaluate the existing IT processes, policies, controls, and performance against the new regulatory requirements and identify any gaps, issues, or risks that need to be addressed. A current state assessment can also help to establish a baseline and a benchmark for measuring the progress and effectiveness of the compliance initiatives.
Aligning IT project portfolio with regulatory requirements is not the first course of action, as it is a subsequent step after performing a current state assessment. Aligning IT project portfolio with regulatory requirements can help to prioritize and allocate resources for the IT projects that support the compliance objectives and deliver value to the business. However, aligning IT project portfolio with regulatory requirements requires a clear understanding of the current state and the desired state of the IT processes and compliance.
Creating an IT balanced scorecard is not the first course of action, as it is a tool for monitoring and reporting the compliance outcomes and impacts. An IT balanced scorecard is a framework that measures and communicates the performance of the IT function in terms of financial, customer, internal process, and learning and growth perspectives. An IT balanced scorecard can help to align the IT strategy with the business strategy, track the progress and results of the IT initiatives, and demonstrate the value and contribution of IT to the business. However, creating an IT balanced scorecard does not provide a comprehensive analysis or improvement plan for the IT processes and compliance.
Identifying the penalties for noncompliance is not the first course of action, as it is only a motivation factor for compliance. Identifying the penalties for noncompliance can help to raise awareness and urgency of the compliance issues and risks, as well as deter or prevent violations or breaches. However, identifying the penalties for noncompliance does not provide a detailed assessment or guidance for achieving compliance.

According to the ISACA paper on Tactics for Effectively Communicating Cybersecurity Risk to Boards of Directors1, the most effective way to initially address the request of providing periodic updates regarding IT risk to the board is to include key IT risks in a dashboard submitted to the board quarterly. A dashboard is a visual tool that can help the board members quickly understand the current status and trends of IT risk, as well as the actions taken or planned to mitigate them. A dashboard should be concise, clear, consistent and relevant, and should highlight the most significant IT risks that could impact the enterprise's objectives and performance. A dashboard should also align with the enterprise's risk appetite and tolerance, and provide recommendations for improvement or escalation. The other options are not as effective as a dashboard, as they may be too detailed, too frequent, too narrow or too reactive for the board's needs.

Qualitative risk assessmentis most appropriate when reliable quantitative data is unavailable or too costly to gather. In such cases, qualitative methods (like risk matrices or expert judgment) provide valuable input based on impact and likelihood without requiring precise numerical data.
This approach is especially useful in new or evolving domains (e.g., cybersecurity or AI) where historical data may be lacking.
Reference:
CGEIT Review Manual: Domain 4 - Risk Optimization: "Qualitative assessments are suitable when quantitative methods are not feasible due to lack of historical data or high costs associated with obtaining it." COBIT 2019 Focus Area: Risk Management.

Goals-based performance appraisals are a method of evaluating employees based on their achievement of specific and measurable objectives that are aligned with the organization's strategy and vision. Goals-based performance appraisals can help to identify the most capable staff who have contributed to the organization's success, demonstrated high performance and potential, and shown commitment and engagement. Reviewing current goals-based performance appraisals across the enterprise can help management to retain the most capable staff regardless of their location, compensation, or length of service12. Reference: Performance Appraisal Methods: Traditional and Modern Methods (with example). How to Conduct a Performance Appraisal.